t-mobile[.]govj[.]cc

The domain t-mobile.govj.cc has been identified as a potential threat for brand impersonation, specifically targeting the brand x.com. The domain appears to be set up for misleading users into believing it is affiliated with x.com, potentially to harvest credentials or perform other malicious activities. Currently, there is no evidence of a crypto drainer kit associated with this domain.

Technical infrastructure analysis reveals several concerning indicators: the domain scored 17 out of 95 on VirusTotal, indicating that multiple security vendors recognize it as a threat. The domain was registered through Gname.com Pte. Ltd., a potentially less scrupulous registrar when it comes to domain vetting. It resolves to an IP address of 47.86.49.23 located in Hong Kong, under the AS45102 network managed by Alibaba (US) Technology Co., Ltd. The domain was created on February 21, 2026, suggesting recent activity. Despite its offline status, it has already been flagged by PhishDestroy and appears on one major security blocklist.

Currently, the domain is offline, reducing its immediate threat; however, it remains a point of concern given its potential for repurposing or reactivation. The fact that it is listed on a security blocklist and recognized by multiple security vendors should prompt ongoing monitoring. Users and organizations should implement strict verification procedures when interacting with websites bearing questionable domain extensions or unusual registrar affiliations. Continued vigilance and regular updates to security blocklists are recommended to mitigate potential exposure to such threats.